Insufficiently Protected Credentials vulnerability in Apache Solr. This issue affects Apache Solr: from 6.0.0 through 8.11.2, from 9.0.0 before 9.3.0. One of the two endpoints that publishes the Solr process' Java system properties, /admin/info/properties, was only setup to hide system properties that had "password" contained in the name. There are a number of sensitive system properties, such as "basicauth" and "aws.secretKey" do not contain "password", thus their values were published via the "/admin/info/properties" endpoint. This endpoint populates the list of System Properties on the home screen of the Solr Admin page, making the exposed credentials visible in the UI. This /admin/info/properties endpoint is protected under the "config-read" permission. Therefore, Solr Clouds with Authorization enabled will only be vulnerable through logged-in users that have the "config-read" permission. Users are recommended to upgrade to version 9.3.0 or 8.11.3, which fixes the issue. A single option now controls hiding Java system property for all endpoints, "-Dsolr.hiddenSysProps". By default all known sensitive properties are hidden (including "-Dbasicauth"), as well as any property with a name containing "secret" or "password". Users who cannot upgrade can also use the following Java system property to fix the issue: '-Dsolr.redaction.system.pattern=.*(password|secret|basicauth).*'

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Insufficiently Protected Credentials vulnerability in Apache Solr. This issue affects Apache Solr: from     6.0.0 through 8.11.2, from 9.0.0 before 9.3.0. One of the two endpoints that publishes the Solr process'     Java system properties, /admin/info/properties, was only setup to hide system properties that had     password contained in the name. There are a number of sensitive system properties, such as basicauth     and aws.secretKey do not contain password, thus their values were published via the     /admin/info/properties endpoint. This endpoint populates the list of System Properties on the home     screen of the Solr Admin page, making the exposed credentials visible in the UI. This     /admin/info/properties endpoint is protected under the config-read permission. Therefore, Solr Clouds     with Authorization enabled will only be vulnerable through logged-in users that have the config-read     permission. Users are recommended to upgrade to version 9.3.0 or 8.11.3, which fixes the issue. A single     option now controls hiding Java system property for all endpoints, -Dsolr.hiddenSysProps. By default all     known sensitive properties are hidden (including -Dbasicauth), as well as any property with a name     containing secret or password. Users who cannot upgrade can also use the following Java system     property to fix the issue: '-Dsolr.redaction.system.pattern=.*(password|secret|basicauth).*'     (CVE-2023-50291)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Insufficiently Protected Credentials vulnerability in Apache Solr. This issue affects Apache Solr: from
    6.0.0 through 8.11.2, from 9.0.0 before 9.3.0. One of the two endpoints that publishes the Solr process'
    Java system properties, /admin/info/properties, was only setup to hide system properties that had
    "password" contained in the name. There are a number of sensitive system properties, such as "basicauth"
    and "aws.secretKey" do not contain "password", thus their values were published via the
    "/admin/info/properties" endpoint. This endpoint populates the list of System Properties on the home
    screen of the Solr Admin page, making the exposed credentials visible in the UI. This
    /admin/info/properties endpoint is protected under the "config-read" permission. Therefore, Solr Clouds
    with Authorization enabled will only be vulnerable through logged-in users that have the "config-read"
    permission. Users are recommended to upgrade to version 9.3.0 or 8.11.3, which fixes the issue. A single
    option now controls hiding Java system property for all endpoints, "-Dsolr.hiddenSysProps". By default all
    known sensitive properties are hidden (including "-Dbasicauth"), as well as any property with a name
    containing "secret" or "password". Users who cannot upgrade can also use the following Java system
    property to fix the issue: '-Dsolr.redaction.system.pattern=.*(password|secret|basicauth).*'
    (CVE-2023-50291)

ID	Name	Product	Family	Type	Severity
250332	Linux Distros Unpatched Vulnerability : CVE-2023-50291	Nessus	Misc.	Local	high
409557	SCA: security update for org.apache.solr:solr-core (GHSA-3hwc-rqwp-v36q)	Tenable Cloud Security	SCA Checks	Local	high
409557	SCA: security update for org.apache.solr:solr-core (GHSA-3hwc-rqwp-v36q)	Tenable Self-Hosted Container Security	SCA Checks	Local	high

Detections

Analytics

CVE-2023-50291

high

Tenable Plugins

high

high

high